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Sir: 

Prior to examination and the calculation of filing fees, kindly amend the above- 
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IN THE SPECIFICATION: 

Page 1, immediately following the title appearing on line 1 and 2, insert the 
following: 

-This disclosure is based upon French Application No. 99/10106, filed on July 30, 
1999 and International Application No. PCT/FR00/02024, filed July 12, 2000, which was 
published on February 8, 2001 in a language other than English, the contents of which are 
incorporated herein by reference. 
Background of the Invention - 



Application No. Unassigned 
Attorney's Docket No. 032326-192 
Page 2 



Page 4, before line 6, insert the following heading: 
-Descriptinn of ihe Tnvention- 

Add the following Abstract: 

-Signature scheme methods, in which security is based on the discrete logarithm 
problem, include a first scheme for total recovery of the message, and a second scheme for 
partial recovery of the message. Two techniques reduce to a minimum the total size of the 
message to be transmitted and the signature. In the first technique, part of the message is 
included inside the signature by appropriately selecting the random data used when the 
signature is generated. In the second technique, part of the octets representing the 
signature are eliminated and the total recovery of the signature is obtained during the 
second verification phase. These schemes and techniques reduce the overall size of the 
signature and the message to be transmitted. They are therefore particularly suitable for 
use on portable media such as smart cards. ~ 

I N THE CLAIMS: 

Kindly replace claims 1-25, as follows. 

1 . (Amended) An electronic signature method comprising a generation method 
and a verification method allowing total reconstitution of a message, said method utilising a 
redundancy function R, a set having a group structure of order r, where r is a prime 
number, with a zero element denoted O and generating the point G, and employing a 
private key that is a positive integer less than r, and a public key being the point W = s.G, 
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said method using a non-zero integer constant k, wherein the signature generation method 
includes the following four steps: 

1) Generating a random number u between 1 and r-1 and calculating V =u.G; 

2) Associating an integer i with the point V and calculating c=i+f modulo r; if 
c=0, returning to step 1; 

3) Calculating the integer d=u" 1 *(k+s*c) modulo r; if d=0, returning to step 

1; and 

4) Utilizing the pair of integers (c,d) as the signature; 

and wherein the signature verification method includes the following six steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [l,r-l], the signature is not valid; 

2) Calculating the integers h = d" 1 modulo r, hi=k*h modulo r and h 2 =c*h 
modulo r; 

3) Calculating the point P = h x G + h 2 W; if P=0, the signature is not valid; 

4) Associating an integer i with the point P; 

5) Calculating the integer f=c-i modulo r; and 

6) Finding the message m from f and verifying that f =R(m); if yes, the 
signature of the message m is valid; otherwise the signature is not valid. 

2. (Amended) An electronic signature method comprising a generation method 
and a signature verification method allowing partial reconstruction of a message, the 
message m to be signed being divided into two parts, the first part nij of constant size being 
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reconstituted from the signature, the second part m 2 being transmitted with the signature of 
the method, said method utilising a redundancy function R, a set having a group structure 
of order r, where r is a prime number, with a zero element denoted O and generating the 
point G, and employing a private key that is a positive integer less than r and a public key 
being the point W = s.G, wherein the method of generating the signature of a message m 
consisting of the messages m 1 and m 2 includes the following six steps: 

1) Generating a random integer u between 1 and r-1 and calculating V=u.G; 

2) Calculating f^R^); 

3) Associating an integer i with the point V and calculating c = i+fj modulo r; 
if c=0, returning to step 1; 

4) Calculating f 2 =H(m 2 ), where H is a hash function; 

5) Calculating the integer d=u" 1 *(f 2 + s*c) modulo r; if d=0, returning to step 

1; and 

6) Utilizing the pair of integers (c,d) as the signature; 

and wherein the signature verification method takes as an input a pair of integers (c,d) and 
the partial message m 2 and comprises the following seven steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [l,r-l], the signature is not valid; 

2) Calculating f 2 =H(m 2 ), where H is a hash function; 

3) Calculating the integers h=d _1 modulo r, h^^h modulo r and h 2 = c*h 
modulo r; 

4) Calculating the point P^G+l^W; if P=0, the signature is not valid; 
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5) Associating the integer i with the point P; 

6) Calculating the integer i\ =c-i modulo r; and 

7) Obtaining the message n^ from fj and verifying that f t =R(m 1 ); if yes, the 
signature of the message m is valid; otherwise the signature is not valid. 

3. (Amended) An electronic signature method comprising a generation method 
and a signature verification method that comprises including part of the message inside the 
signature by suitably choosing the random data used during the generation of the signature. 

4. (Amended) An electronic signature method comprising a generation method 
and a signature verification method that comprises the steps of eliminating some of the 
bytes representing the signature, and reconstituting the signature during the verification 
phase. 

5. (Amended) A method according to claim 3 for improving the Nyberg- 
Rueppel signature scheme, comprising a generation method and a verification method in 
which part of the message of size t bytes is included in the integer d, t being a small 
integer, the signature being a pair of integers (c,d), the t least significant bytes of an integer 
g containing t bytes of the message, the said method using a redundancy function R, a set 
having a group structure of order r, where r is a prime number, with a zero element 
denoted O and generating the point G, and employing a private key that is a positive integer 
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s less than r and a public key being the point W = s.G, wherein the method of generating 
the signature of a message m includes the following five steps: 

1) Removing the t least significant bytes of the message m and storing the result 
in m'; calculating f=R(m'); 

2) Generating a random number u between 1 and r-1 and calculating V=u.G; 

3) Associating an integer i with the point V and calculating c=i+f modulo r; 
returning to step 1 if c=0. 

4) Calculating the integer d=u-s*c modulo r; if d is not equal to m modulo 2 8t , 
returning to step 2; and 

5) Utilizing the pair of integers (c,d) as the signature; 

and wherein the signature verification method includes the following five steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [0,r-l], the signature is not valid; 

2) Calculating the point P = d . G + c . W ; if P = 0 , the signature is not valid ; 

3) Associating the integer i with the point P; 

4) Calculating the integer f=c-i modulo r; 

5) Obtaining the message m' from f and verifying that f=R(m'); if such is not 
the case, the signature is not valid; if such is the case, the signature is valid and the 
message m is the concatenation with the message m' of the t least significant bytes of the 
integer d. 
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6. (Amended) A method according to claim 5 for the preprocessing of the 
signature generation to accelerate the generation of the signatures, said method comprising 
a pretreatment phase and a signature generation phase, said pretreatment phase taking as an 
input a secret key s and putting in memory in a table a large number of values (i, xj with 
x u =u-s*i modulo r and i being the integer associated with the point V=u.G, so that these 
values can be accessed by the remainder of x u modulo 2 8t , said signature generation phase 
utilising a redundancy function R, a set having a group structure of order r, where r is a 
prime number, with a zero element denoted O and generating the point G, and employing a 
private key that is a positive integer s less than r and a public key being the point W = s.G, 
said signature generation phase comprising the following eight steps: 

1) Removing the t least significant bytes in the message m and storing the result 
in the message m'; calculating f=R(m'). The t least significant bytes of the message m are 
stored in the integer d; 

2) Calculating the integer y = s*f modulo r and the integer 1 =y modulo 2 8t ; 

3) If y < r/2, first of all executing step 4 and next step 5 ; otherwise executing 
first of all step 5 and next step 4; 

4) Accessing the elements of the table where the remainder modulo 2 8t is 1 +d 
modulo 2 8t and selecting an element such that x u is greater than or equal to y; if such an 
element exists, it is eliminated from the table and the method passes to step 6; 

5) Accessing the elements of the table where the remainder modulo 2 8t is 
1+d + r modulo 2 8t and selecting an element such that x u is less than y; if such an element 
exists, it is eliminated from the table and the method passes to step 6; 
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6) Calculating the integer d=x u -y modulo r; 

7) Obtaining the integer i associated with x u and calculating c=i+f modulo r; 

and 

8) Utilizing the pair of integers (c,d) as the signature. 



7. (Amended) A method according to claim 2 for improving the signature 
scheme with partial reconstitution of the message, said method comprising a signature 
generation method and a signature verification method, said method including part of the 
message of size t bytes in the integer d, t being a small integer, the t least significant bytes 
of the integer d containing t bytes of the message, said method utilising a redundancy 
function R, a set having a group structure of order r, where r is a prime number, with a 
zero element denoted O and generating a point G, and employing a private key that is a 
positive integer less than r and a public key being the point W=s.G, wherein the method of 
generating the signature of a message m consisting of the messages m 1 and m 2 includes the 
following six steps: 

1) Generating a random integer u between 1 and r-1 and calculating V=u.G; 

2) Calculating f , = R^) ; 

3) Associating an integer i with the point V and calculating c=i+fj modulo r; 
if c=0, returning to step 1; 

4) Calculating f 2 =H(m 2 ), where H is a hash function; 

5) Calculating the integer d=u 1 *(f 2 +s*c) modulo r; if d=0 or if d is not equal 
to m 2 modulo 2 8t , returning to step 1 ; and 
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6) Utilizing the pair of integers (c,d) as the signature, and the message to be 
transmitted is m' 2 consisting of m 2 deprived of its t least significant bytes; 
and wherein the signature verification method takes as an input a pair of integers (c,d) and 
the partial message m\ and comprises the following eight steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [l,r-l], the signature is not valid; 

2) Making up m' 2 as m 2 by adding to it the t least significant bytes of d; 

3) Calculating f 2 =H(m 2 ), where H is a hash function; 

4) Calculating the integers h=d _1 modulo r, h, = f 2 *h modulo r and h 2 =c*h 
modulo r; 

5) Calculating the point P^G+l^W; if P =0 the signature is not valid; 

6) Associating the integer i with the point P; 

7) Calculating the integer fj =c-i modulo r; and 

8) Obtaining the message m x from fjand verifying that f t =^1^); if yes, the 
signature of the message m is valid; otherwise the signature is not valid. 



8. (Amended) A method that includes removing t bytes from a chain of bytes 
representing an integer d from a signature that is the pair of integers (c,d), said method 
comprising a signature generation method and a signature verification method, said method 
being applied to the Nyberg and Rueppel signature scheme, wherein the signature 
generation method includes the following two steps: 
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1) Generating the signature of the message m using the Nyberg and Rueppel 
signature scheme, to obtain the pair of integers (c,d); and 

2) Calculating d', the integer quotient of the division of the integer d by 2 8t ; and 
utilizing the pair of integers (c,d') as the signature; 

and wherein the signature verification method takes as an input a pair (c,d') and includes 
the following five steps: 

1) If c does not belong to the interval [l,r-l], the signature is not valid; 

2) Calculating the point P = d' *2 8t .G + c. W; 

3) For j ranging from 0 to 2 8t -l, executing the following steps: 
3a) If P = O , executing step 3d) ; 

3b) Associating the integer i with the point P and calculating the integer f=c-i 
modulo r; 

3c) Finding the message m from f and verifying that f=R(m); if yes, executing 

step 5; 

3d) Replacing P with P + G; 

4) The signature is not valid and the method is terminated; 

5) If the integer d=d'*2 8t +j does not belong to the interval [0,r-l], the 
signature is not valid; otherwise the signature is valid and the method is terminated. 



9. (Amended) A method that includes removing t bytes from a chain of bytes 
representing an integer d from a signature that is the pair of integers (c,d), said method 
comprising a signature generation method and a signature verification method, with partial 
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reconstitution of a message according to Claim 2, wherein the signature generation method 
includes the following two steps: 

1) Generating the signature of a message m using the signature scheme with 
partial reconstruction of the message according to claim 2, in order to obtain the pair of 
integers (c,d); and 

2) Calculating d', the integer quotient of the division of the integer d by 2 8t ; 
wherein the signature is the pair of integers (c,d'); 

and wherein the modified signature verification method takes as an input a pair (c,d') and a 
message m 2 and includes the following two steps: 

1) For i ranging from 0 to 2 8t -l, calculating the integer d=d'*2 8t +i and 
executing the signature verification method with partial reconstitution of the message 
according to claim 2, the signature to be verified being (c,d); if the signature verification 
method recognises the signature (c,d) as valid, the signature is valid, and the method is 
terminated; 

2) Otherwise the signature is not valid. 

10. (Amended) A method for improving the Nyberg and Rueppel scheme 
making it possible to increase the size of the messages to be signed by t bytes, t being an 
integer variable, said method comprising a signature generation method and a signature 
verification method, said method utilising a redundancy function R, a set having a group 
structure of order r, where r is a prime number, with a zero element denoted O and 
generating the point G, and employing a private key that is a positive integer s less than r 
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and a public key being the point W = s.G, wherein the method of generating the signature of 
a message m includes the following five steps: 

1) Generating a random number u and calculating V=u.G; 

2) Obtaining the message m' by removing from the message m the t least 
significant bytes and calculating f=R(m'); 

3) Associating an integer i with the point V and calculating c=i+f modulo r; 
returning to step 1 if c=0 and if i is not equal to m modulo 2 8t ; 

4) Calculating d=u-s*c modulo r; and 

5) Utilizing the pair of integers (c,d) as the signature; 

and wherein the signature verification method includes the following four steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [0,r-l], the signature is not valid; 

2) Calculating the point P=d.G+c.W; if P=0, the signature is not valid; 

3) Associating the integer i with the point P and calculating the integer f=c-i 
modulo r; and 

4) Finding the message m' from f and verifying that f=R(m'); if yes, finding 
the message m by concatenating the t least significant bytes of i with the message m'. The 
signature of the message m is then valid; otherwise the signature is not valid. 

1 1 . (Amended) A method for improving a signature scheme with partial 
reconstitution of the message according to Claim 2, said method comprising a signature 
generation method and a signature verification method, and making it possible to increase 
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by t bytes the size of the message m l reconstituted from the signature, t being an integer 
variable, said method utilising a redundancy function R, a set having a group structure of 
order r, where r is a prime number, with a zero element denoted O and generating the point 
G, and employing a private key that is a positive integer less than r and a public key being 
the point W=s.G, wherein the method of generating the signature of a message m includes 
the following six steps: 

1) Generating a random integer u between 1 and r-1 and calculating V=u.G; 

2) Obtaining m\ by removing the t least significant bytes from the message m x . 
Calculating f^RCm'j); 

3) Associating an integer i with the point V and calculating 0 = 1+^ modulo r; 
if c=0 or if i is not equal to n^ modulo 2 8t , returning to step 1; 

4) Calculating f 2 =H(m 2 ), where H is a hash function; 

5) Calculating the integer d=u" 1 *(f 2 + s*c) modulo r; if d=0, returning to step 

1; and 

6) Utilizing the pair of integers (c,d) as the signature; 

and wherein the signature verification method takes as an input a pair of integers (c,d) and 
the partial message m 2 and comprises the following seven steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [l,r-l], the signature is not valid; 

2) Calculating f 2 =H(m 2 ), where H is a hash function; 

3) Calculating the integers h=d _1 modulo r, h, = f 2 *h modulo r and h 2 =c*h 
modulo r; 
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4) Calculating the point P=h 1 G+h 2 W; if P=0, this signature is not valid. 

5) Associating the integer i with the point P; 

6) Calculating the integer f^c-i modulo r; and 

7) Obtaining the message m' x from fj and verifying that f t =R(m' 1 ); if yes, 
obtaining by concatenating the t least significant bytes of the integer i with the message 
m\. The signature of the message m is then valid; otherwise the signature is not valid. 

12. (Amended) A method according to claim 1 1 for preprocessing the 
calculations making it possible to increase performance, comprising the further step of 
putting in memory in a table the pairs of integers (u,i) so that these integers are accessible 
to the value of i modulo 2 8t , t being an integer parameter. 

13. (Amended) A method for improving the Nyberg and Rueppel signature 
scheme consisting in removing t bytes from an integer c, t being an integer variable, said 
method comprising a signature generation method and a signature verification method, the 
signature consisting of the pair of integers (c,d), wherein the signature generation method 
includes the following two steps: 

1) Generating the signature of a message m using the Nyberg-Rueppel signature 
scheme in order to obtain the pair of integers (c,d); and 

2) Calculating c', the integer quotient of the division of the integer c by 2 8t , and 
employing the pair of integers (c',d) as the signature; 
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and wherein the signature verification method takes as an input the pair of integers (c',d) 
and includes the following five steps: 

1) If d does not belong to the interval [0,r-l], the signature is not valid; 

2) Calculating the point P=d.G+c'*2 8, .W; 

3) For j ranging from 0 to 2 8t -l, executing the following steps: 
3a) If P = O , executing step 3d) ; 

3b) Associating the integer i with the point P and calculating the integer f=c-i 
modulo r; 

3c) Finding the message m from f and verifying that f=R(m); if yes, executing 

step 5; 

3d) Replacing P by P + W ; 

4) The signature is not valid and the method is terminated; 

5) If the integer c = c'*2 8t +j does not belong to the interval [l,r-l], the 
signature is not valid; otherwise the signature is valid and the method is terminated. 



14. (Amended) A method according to claim 2 for improving the signature 
scheme with partial reconstitution of the message that includes the further step of removing 
t bytes from the integer c, t being an integer variable, said method comprising a signature 
generation method and a signature verification method, wherein the signature generation 
method comprises the following two steps: 

1) Generating the signature of the message m, using the signature scheme with 
partial reconstitution of the message in order to obtain the pair of integers (c,d); and 



Application No. Unal ign ed 
Attorney's Docket No. 032326-192 
Page 16 

2) Calculating c\ the integer quotient of the division of the integer c by 2 8t ; and 
utilizing the pair of integers (c',d) as the signature; 

and wherein the signature verification method takes as an input a pair of integers (c',d) and 
a message m 2 and comprises the following eight steps: 



1) 
2) 
3) 

modulo r; 
4) 
5) 
6) 



If d does not belong to the interval [1 ,r-l], the signature is not valid; 
Calculating f 2 =H(m 2 ), where H is a hash function; 

Calculating the integers h=d _1 modulo r, h^f/h modulo r and h 2 = c'*2 8t *h 



Calculating the point P^.G+b^.W; 
Calculating the point Z=h.W; 

For j ranging from 0 to 2 8t -l, executing the following steps: 
6a) If P = 0, executing step 6d); 

6b) Associating the integer i with the point P and calculating the integer f t =c-i 
modulo r; 

6c) Finding the message nij from fj and verifying that f^R^); if yes, 
executing step 8; 

6d) Replacing P with P+Z; 

7) The signature is not valid and the method is terminated; 

8) If the integer c = c'*2 8t +j does not belong to the interval [l,r-l], the 
signature is not valid; otherwise the signature is valid and the method is terminated. 
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15. (Amended) A method according to claim 1 for modifying the signature 
scheme with partial reconstruction of the message comprising the further step of replacing 
the signature (c,d) with the signature (h 2 ,d) with h 2 =c*d _1 modulo r. 

16. (Amended) A method for improving the Nyberg-Rueppel signature scheme, 
said method comprising a signature generation method and a signature verification method, 
the said method having the step of including part of a message of size t bytes in an integer 
d, the signature being the pair of integers (c,d), t being a small integer, the t least 
significant bytes of the integer d containing t bytes of the message, the said method utilising 
a set having a group structure of order r, where r is a prime number, with a zero element 
denoted O and generating the point G, and employing a private key that is a positive integer 
s less than r and a public key being the point W = s.G, wherein the method of generating 
the signature of a message m using the integer parameters t, a and k includes the following 
seven steps: 

1) Calculating h=H(m), H being a hash function; 

2) Removing the t least significant bytes and the k most significant bytes of the 
message m and storing the result in m' ; 

3) Storing as f the result of the concatenation with m' of the a most significant 
bytes of h; 

4) Generating a random number u between 1 and r-1 and calculating V=u.G; 

5) Associating an integer i with the point V and calculating c=i+f modulo r; 
returning to step 4 if c=0; 
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6) Calculating the integer d=u-s*c modulo r; if d is not equal to m modulo 2 8t 
returning to step 4; and 

7) Utilizing the pair of integers (c,d) as the signature; 

and wherein the signature verification method includes the following seven steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [0,r-l], the signature is not valid; 

2) Calculating the point P=d.G+c.W; if P=0, the signature is not valid; 

3) Associating the integer i with the point P; 

4) Calculating the integer f=c-i modulo r; 

5) Concatenating the t least significant bytes of d with the message m' obtained 
from f by removing the a least significant bytes; 

6) For b ranging from 0 to 2 8k -l, repeating the following step: 

6a) Concatenating the message m' with b in order to obtain m and calculating 
h=H(m); verifying that the a most significant bytes of h and the a least significant bytes of 
f are identical; if yes, the signature of the message m is valid and the method is terminated; 

7) Otherwise the signature is not valid. 

17. (Amended) A method for generating and verifying an electronic signature 
according to claim 1 , wherein the operations are effected on an elliptic curve forming a 
group structure and having at least one point G, which is the generator of a sub-group of 
order r. 
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18. (Amended) A method for generating and verifying an electronic signature 
according to claim 1, wherein the operations are effected in the multiplicative group of the 
integers modulo a prime number p. 

19. (Amended) A method for generating and verifying an electronic signature 
according to claim 1, wherein the operations are effected in a multiplicative sub-group of 
order r of the multiplicative group of the integers modulo a prime number p with r dividing 
p-1. 

20. (Amended) An electronic device that executes the method of claim 1, 
wherein said device is a portable device. 

21. (Amended) An electronic device that executes the method of claim 1, 
wherein the device is a smart card. 

22. (Amended) An electronic device that executes the method of claim 1, 
wherein the device is a contactless card. 

23. (Amended) An electronic device that executes the method of claim 1, 
wherein the device is a PCMCIA card. 
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24. (Amended) An electronic device that executes the method of claim 1, 
wherein the device is a badge. 

25. (Amended) An electronic device that executes the method of claim 1, 
wherein the device is an intelligent watch. 

Add the following new claims: 

26. (New) A method according to claim 10 for preprocessing the calculations 
making it possible to increase performance, comprising the further step of putting in 
memory in a table the pairs of integers (u,i) so that these integers are accessible to the value 
of i modulo 2 8t , t being an integer parameter. 

27. (New) A method according to claim 2 for modifying the signature scheme 
with partial reconstruction of the message comprising the further step of replacing the 
signature (c,d) with the signature (h 2 ,d) with h 2 = c*d -1 modulo r. 

28. (New) A method for generating and verifying an electronic signature 
according to claim 2, wherein the operations are effected on an elliptic curve forming a 
group structure and having at least one point G, which is the generator of a sub-group of 
order r. 
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29. (New) A method for generating and verifying an electronic signature 
according to claim 2, wherein the operations are effected in the multiplicative group of the 
integers modulo a prime number p. 

30. (New) A method for generating and verifying an electronic signature 
according to claim 2, wherein the operations are effected in a multiplicative sub-group of 
order r of the multiplicative group of the integers modulo a prime number p with r dividing 
p-1. 

REMARKS 

Entry of the foregoing amendment is respectfully requested. This amendment is 
intended to place the claims in a more conventional format and eliminate the multiple 
dependency of the claims. 
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1 . (Amended) An electronic signature method comprising a generation method 
and a verification method allowing total reconstitution of [the] a message, [the] said method 
utilising a redundancy function R, a set having a group structure of order r, where r is a 
prime number [r] , with a zero element denoted O and generating the point G, [the] and 
employing a private key [being] that is a positive integer less than r, [the] and a public key 
being the point W = s.G, [the] said method using a non-zero integer constant k, 
[characterised in that] wherein the signature generation method includes the following four 
steps: 

1) Generating a random number u between 1 and r-1 and calculating V=u.G; 

2) Associating an integer i with the point V and calculating c=i+f modulo r; if 
c=0, returning to step 1[)]; 

3) Calculating the integer d=u" 1 *(k+s*c) modulo r; if d=0, returning to step 
ID]; and 

4) [The signature is] Utilizing the pair of integers (c,d) as the signature ; 
and [in that] wherein the signature verification method includes the following six steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [l,r-l], the signature is not valid; 

2) Calculating the integers h = d" 1 modulo r, hj =k*h modulo r and h 2 =c*h 
modulo r; 

3) Calculating the point P = hjG + h 2 W; if P=0, the signature is not valid; 
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4) Associating an integer i with the point P; 

5) Calculating the integer f=c-i modulo r; and 

6) Finding the message m from f and verifying that f=R(m); if yes, the 
signature of the message m is valid; otherwise the signature is not valid. 

2. (Amended) An electronic signature method comprising a generation method 
and a signature verification method allowing partial reconstruction of [the] a message, the 
message m to be signed being divided into two parts, the first part m l of constant size being 
reconstituted from the signature, the second part m 2 being transmitted with the signature of 
the method, [the] said method utilising a redundancy function R, a set having a group 
structure of order r t where r is a prime number [r], with a zero element denoted O and 
generating the point G, [the] and employing a private key [being] that is a positive integer 
less than r and [the] a public key being the point W=s.G, [characterised in that] wherein 
the method of generating the signature of a message m consisting of the messages m 1 and 
m 2 includes the following six steps: 

1) Generating a random integer u between 1 and r-1 and calculating V=u.G; 

2) Calculating f, = R^); 

3) Associating an integer i with the point V and calculating c=i+f! modulo r; 
if c=0, returning to step 1; 

4) Calculating f 2 =H(m 2 ), where H is a hash function; 
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5) Calculating the integer d=u" 1 *(f 2 +s*c) modulo r; if d=0, returning to step 

1; and 

6) [The signature is] Utilizing the pair of integers (c,d) as the signature; 

and [in that] wherein the signature verification method takes as an input a pair of integers 
(c,d) and the partial message m 2 and comprises the following seven steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [l,r-l], the signature is not valid; 

2) Calculating f 2 =H(m 2 ), where H is a hash function; 

3) Calculating the integers h=d _1 modulo r, h x =f 2 *h modulo r and h 2 =c*h 
modulo r; 

4) Calculating the point P^^+hjW; if P=0, the signature is not valid; 

5) Associating the integer i with the point P; 

6) Calculating the integer f x = c-i modulo r; and 

7) Obtaining the message m x from f x and verifying that fj =R(mj); if yes, the 
signature of the message m is valid; otherwise the signature is not valid. 



3. (Amended) An electronic signature method comprising a generation method 
and a signature verification method [characterised in that it consists in] that comprises 
including part of the message inside the signature by suitably choosing the random data 
used during the generation of the signature. 
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4. (Amended) An electronic signature method comprising a generation method 
and a signature verification method[, characterised in that it consists in] that comprises the 
steps of eliminating some of the bytes representing the signature, [the complete 
reconstitution of] and reconstituting the signature [taking place] during the verification 
phase. 

5. (Amended) A method according to claim 3 for improving the Nyberg- 
Rueppel signature scheme [according to Claim 3] , comprising a generation method and a 
verification method [and consisting in including] in which part of the message of size t 
bytes is included in the integer d, t being a small integer, the signature being [the] a pair of 
integers (c,d), the t least significant bytes of [the] an integer g containing t bytes of the 
message, the said method using a redundancy function R, a set having a group structure of 
order r T where r is a prime number [r], with a zero element denoted O and generating the 
point G, [the] and employing a private key [being] that is a positive integer s less than r and 
[the] a public key being the point W=s.G, [characterised in that] wherein the method of 
generating the signature of a message m includes the following five steps: 

1) Removing the t least significant bytes of the message m and storing the result 
in m'; calculating f=R(m'); 

2) Generating a random number u between 1 and r-1 and calculating V=u.G; 
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3) Associating an integer i with the point V and calculating c=i+f modulo r; 

returning to step 1[)] if c=0. 

4) Calculating the integer d=u-s*c modulo r; if d is not equal to m modulo 2 8t , 
returning to step 2[)]; and 

5) [The signature is] Utilizing the pair of integers (c,d) as the signature : 
and [in that] wherein the signature verification method includes the following five steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [0,r-l], the signature is not valid; 

2) Calculating the point P=d.G+c.W; if P=0, the signature is not valid; 

3) Associating the integer i with the point P; 

4) Calculating the integer f=c-i modulo r; 

5) Obtaining the message m' from f and verifying that f=R(m'); if such is not 
the case, the signature is not valid; if such is the case, the signature is valid and the 
message m is the concatenation with the message m' of the t least significant bytes of the 
integer d. 

6. (Amended) A method according to claim 5 for the preprocessing of the 
signature generation [according to Claim 5, making it possible] to accelerate the generation 
of the signatures, [the] said method comprising a pretreatment phase and a signature 
generation phase, [the] said pretreatment phase taking as an input [the] a secret key s and 
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[consisting in] putting in memory in a table a large number of values (i, xj with x u =u-s*i 
modulo r and i being the integer associated with the point V=u.G, so that these values can 
be accessed by the remainder of modulo 2 8t , [the] said signature generation phase 
utilising a redundancy function R, a set having a group structure of order r, where r is a 
prime number [r] , with a zero element denoted O and generating the point G, [the] and 
employing a private key [being] that is a positive integer s less than r and [the] a public key 
being the point W=s.G, [the] said signature generation phase [being characterised by] 
comprising the following eight steps: 

1) Removing the t least significant bytes in the message m and storing the result 
in the message m'; calculating f=R(m'). The t least significant bytes of the message m are 
stored in the integer d; 

2) Calculating the integer y = s*f modulo r and the integer l=y modulo 2 8t ; 

3) If y <r/2, first of all executing step 4 and next step 5; otherwise executing 
first of all step 5 and next step 4; 

4) Accessing the elements of the table where the remainder modulo 2 8t is 1+d 
modulo 2 8t and selecting an element such that x u is greater than or equal to y; if such an 
element exists, it is eliminated from the table and the method passes to step 6[)]; 

5) Accessing the elements of the table where the remainder modulo 2 8t is 
1+d+r modulo 2 8t and selecting an element such that x u is less than y; if such an element 
exists, it is eliminated from the table and the method passes to step 6[)]; 
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6) Calculating the integer d=x u -y modulo r; 

7) Obtaining the integer i associated with x„ and calculating c=i+f modulo r; 



8) [The signature is] Utilizing the pair of integers (c,d) as the si gn ature . 



7. (Amended) A method according to claim 2 for improving the signature 
scheme with partial reconstitution of the message [according to Claim 2] , [the] said method 
comprising a signature generation method and a signature verification method, [the] said 
method [consisting in] including part of the message of size t bytes in the integer d [defined 
previously], t being a small integer, the t least significant bytes of the integer d containing t 
bytes of the message, [the] said method utilising a redundancy function R, a set having a 
group structure of order r, where r is a prime number [r], with a zero element denoted O 
and generating a point G, [the] and employing a private key [being] that is a positive 
integer less than r and [the] a public key being the point W=s.G, [characterised in that] 
wherein the method of generating the signature of a message m consisting of the messages 
m { and m 2 includes the following six steps: 

1) Generating a random integer u between 1 and r-1 and calculating V=u.G; 

2) Calculating f x = RimJ ; 

3) Associating an integer i with the point V and calculating c=i+fj modulo r; 
if c=0, returning to step 1; 



and 
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4) Calculating f 2 =H(m 2 ), where H is a hash function; 

5) Calculating the integer d=u 1 *(f 2 +s*c) modulo r; if d=0 or if d is not equal 
to m 2 modulo 2 8t , returning to step 1; and 

6) [The signature is] Utilizing the pair of integers (c,d) as the signature, and the 
message to be transmitted is m' 2 consisting of m 2 deprived of its t least significant bytes; 
and [in that] wherein the signature verification method takes as an input a pair of integers 
(c,d) and the partial message m' 2 and comprises the following eight steps: 

1) If c does not belong to the interval [1 ,r-l] or if d does not belong to the 
interval [l,r-l], the signature is not valid; 

2) Making up m' 2 as m 2 by adding to it the t least significant bytes of d; 

3) Calculating ^=13(1%), where H is a hash function; 

4) Calculating the integers h=d _1 modulo r, h x =f 2 *h modulo r and h 2 =c*h 
modulo r; 

5) Calculating the point P=h 1 G+h 2 W; if P=0 the signature is not valid; 

6) Associating the integer i with the point P; 

7) Calculating the integer f L = c-i modulo r; and 

8) Obtaining the message m 1 from ^and verifying that fj =R(m 1 ); if yes, the 
signature of the message m is valid; otherwise the signature is not valid. 
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8. (Amended) A method [consisting in] that includes removing t bytes from 
[the] a chain of bytes representing [the] an integer d [when the] from a signature that is the 
pair of integers (c,d), [the] said method comprising a signature generation method and a 
signature verification method, [the] said method being applied to the Nyberg and Rueppel 
signature scheme, [characterised in that] wherein the [modified] signature generation 
method includes the following two steps: 

1) Generating the signature of the message m using the Nyberg and Rueppel 
signature scheme, to obtain the pair of integers (c,d); and 

2) Calculating d', the integer quotient of the division of the integer d by 2 8t ; 
[the signature is] and utilizing the pair of integers (c,d') as the sig n a t ure ; 

and [in that the modified] wherein the signature verification method takes as an input a pair 
(c,d') and includes the following five steps: 

1) If c does not belong to the interval [l,r-l], the signature is not valid; 

2) Calculating the point P=d'*2 8t .G+c.W; 

3) For j ranging from 0 to 2 8t -l, executing the following steps: 
3[)]a) If P=0, executing step 3[)]d); 

3[)]b) Associating the integer i with the point P and calculating the integer f=c-i 
modulo r; 

3[)]c) Finding the message m from f and verifying that f=R(m); if yes, executing 
step5[)]; 
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3[)]d) Replacing P with P+G; 

4) The signature is not valid and the method is terminated; 

5) If the integer d=d'*2 8t +j does not belong to the interval [0,r-l], the 
signature is not valid; otherwise the signature is valid and the method is terminated. 

9. (Amended) A method [consisting in] th at include s removing t bytes from 
[the] a chain of bytes representing [the] an integer d [when the] from a signature that is the 
pair of integers (c,d), [the] said method comprising a signature generation method and a 
signature verification method, [the said method to the signature diagram] with partial 
reconstitution of [the] a message according to Claim 2, [characterised in that the modified] 
wherein the signature generation method includes the following two steps: 

1) Generating the signature of [the] a message m using the signature scheme 
with partial reconstruction of the message [previously described] according to claim 2 , in 
order to obtain the pair of integers (c,d); and 

2) Calculating d\ the integer quotient of the division of the integer d by 2 8t ; 
wherein the signature is the pair of integers (c,d'); 

and [in that] wherein the modified signature verification method takes as an input a pair 
(c,d') and a message m 2 and includes the following two steps: 

1) For i ranging from 0 to 2 8t -l, calculating the integer d=d'*2 8t +i and 
executing the signature verification method with partial reconstitution of the message 
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[previously described] according to claim 2 . the signature to be verified being (c,d); if the 
signature verification method recognises the signature (c,d) as valid, the signature is valid, 
and the method is terminated; 

2) Otherwise the [The] signature is not valid. 

10. (Amended) A method for improving the Nyberg and Rueppel scheme 
making it possible to increase the size of the messages to be signed by t bytes, t being an 
integer variable, [the] said method comprising a signature generation method and a 
signature verification method, [the] said method utilising a redundancy function R, a set 
having a group structure of order r, where r is a prime number [r] , with a zero element 
denoted O and generating the point G, [the] and employing a private key [being] that is a 
positive integer s less than r and [the] a public key being the point W = s.G, [characterised 
in that] wherein the method of generating the signature of a message m includes the 
following five steps: 

1) Generating a random number u and calculating V=u.G; 

2) Obtaining the message m' by removing from the message m the t least 
significant bytes and calculating f=R(m'); 

3) Associating an integer i with the point V and calculating c = i+f modulo r; 
returning to step 1[)] if c = 0 and if i is not equal to m modulo 2 8t ; 

4) Calculating d=u-s*c modulo r; and 
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5) [The signature is] Utilizing the pair of integers (c,d) as the signature; 
and [in that] wherein the signature verification method includes the following four steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [0,r-l], the signature is not valid; 

2) Calculating the point P = d.G + c.W; if P = 0, the signature is not valid; 

3) Associating the integer i with the point P and calculating the integer f=c-i 
modulo r; and 

4) Finding the message m' from f and verifying that f=R(m'); if yes, finding 
the message m by concatenating the t least significant bytes of i with the message m'. The 
signature of the message m is then valid; otherwise the signature is not valid. 

1 1 . (Amended) A method for improving [the] a signature scheme with partial 
reconstitution of the message according to Claim 2, [the] said method comprising a 
signature generation method and a signature verification method, [the said method] and 
making it possible to increase by t bytes the size of the message m, reconstituted from the 
signature, t being an integer variable, said method utilising a redundancy function R, a set 
having a group structure of order r, where r is a prime number [r] , with a zero element 
denoted O and generating the point G, [the] and employing a private key [being] that is a 
positive integer less than r and [the] a public key being the point W = s.G, [characterised in 
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that] wherein the method of generating the signature of a message m includes the following 
six steps: 

1) Generating a random integer u between 1 and r-1 and calculating V=u.G; 

2) Obtaining m\ by removing the t least significant bytes from the message m^ 
Calculating f\ = R(m' t ) ; 

3) Associating an integer i with the point V and calculating c=i+fj modulo r; 
if c=0 or if i is not equal to m 1 modulo 2 8t , returning to step 1; 

4) Calculating f 2 =H(m 2 ), where H is a hash function; 

5) Calculating the integer d=u" 1 *(f 2 + s*c) modulo r; if d=0, returning to step 

1; and 

6) [The signature is] Utilizing the pair of integers (c,d) as the signature : 

and [in that] wherein the signature verification method takes as an input a pair of integers 
(c,d) and the partial message m 2 and comprises the following seven steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [l,r-l], the signature is not valid; 

2) Calculating f 2 =H(m 2 ), where H is a hash function; 

3) Calculating the integers h=d _1 modulo r, h! = f 2 *h modulo r and h 2 =c*h 
modulo r; 

4) Calculating the point P^jG+hjW; if P=0, this signature is not valid. 

5) Associating the integer i with the point P; 
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6) Calculating the integer f t =c-i modulo r; and 

7) Obtaining the message m\ from f x and verifying that fj = R(m' 1 ); if yes, 
obtaining nij by concatenating the t least significant bytes of the integer i with the message 
m'j. The signature of the message m is then valid; otherwise the signature is not valid. 

12. (Amended) A method accordin g to claim 1 1 for preprocessing the 
calculations making it possible to increase [the performances of the methods according to 
Claims 10 and 11, characterised in that it consists in] performance, compris ing the further 
step of putting in memory in a table the pairs of integers (u,i) [as defined previously] so 
that these integers are accessible to the value of i modulo 2 8t , t being an integer parameter. 

13. (Amended) A method for improving the Nyberg and Rueppel signature 
scheme consisting in removing t bytes from [the] an integer c, t being an integer variable, 
[the] said method comprising a signature generation method and a signature verification 
method, the signature consisting of the pair of integers (c,d), [characterised in that] wherein 
the signature generation method includes the following two steps: 

1) Generating the signature of [the] a message m using the Nyberg-Rueppel 
signature scheme in order to obtain the pair of integers (c,d); and 

2) Calculating c', the integer quotient of the division of the integer c by 2 8t , and 
employing [. The signature is] the pair of integers (c',d) as the signature ; 
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and [in that] wherein the signature verification method takes as an input the pair of integers 
(c',d) and includes the following five steps: 

1) If d does not belong to the interval [0,r-l], the signature is not valid; 

2) Calculating the point P=d.G+c'*2 8t .W; 

3) For j ranging from 0 to 2 8t -l, executing the following steps: 
3[)]a) If P=0, executing step 3[)]d); 

3[)]b) Associating the integer i with the point P and calculating the integer f=c-i 
modulo r; 

3[)]c) Finding the message m from f and verifying that f =R(m); if yes, executing 
step5[)]; 

3[)]d) Replacing P by P+W; 

4) The signature is not valid and the method is terminated; 

5) If the integer c=c'*2 8t +j does not belong to the interval [l,r-l], the 
signature is not valid; otherwise the signature is valid and the method is terminated. 



14. (Amended) A method according to claim 2 for improving the signature 
scheme with partial reconstitution of the message [according to Claim 2, consisting in] that 
includes the further step of removing t bytes from the integer c [defined according to Claim 
2], t being an integer variable, [the] said method comprising a signature generation method 
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and a signature verification method, [characterised in that] wherein the signature generation 

method comprises the following two steps: 

1) Generating the signature of the message m, using the signature scheme with 
partial reconstitution of the message in order to obtain the pair of integers (c,d); and 

2) Calculating c', the integer quotient of the division of the integer c by 2 8t ; [the 
signature is] and utilizing the pair of integers (c',d) as the sig n ature ; 

and [in that] wherein the signature verification method takes as an input a pair of integers 
(c',d) and a message m 2 and comprises the following eight steps: 

1) If d does not belong to the interval [l,r-l], the signature is not valid; 

2) Calculating f 2 =H(m 2 ), where H is a hash function; 

3) Calculating the integers h=d _1 modulo r, h t =f 2 *h modulo r and h 2 =c'*2 8t *h 
modulo r; 

4) Calculating the point P=hj .G+h 2 . W; 

5) Calculating the point Z =h. W; 

6) For j ranging from 0 to 2 8t -l, executing the following steps: 
6[)]a) If P=0, executing step 6[)]d); 

6[)]b) Associating the integer i with the point P and calculating the integer fj = c-i 
modulo r; 

6[)]c) Finding the message nij from f, and verifying that f t =R(m,); if yes, 
executing step 8[)]; 
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6[)]d) Replacing P with P+Z; 

7) The signature is not valid and the method is terminated; 

8) If the integer c=c'*2 8t +j does not belong to the interval [l,r-l], the 
signature is not valid; otherwise the signature is valid and the method is terminated. 

15. (Amended) A method according to claim 1 for modifying the signature 
scheme with partial reconstruction of the message [according to any one of the preceding 
claims, characterised in that it consists in] comprising the further step of replacing the 
signature (c,d) with the signature (h 2 ,d) with h 2 =c*d" 1 modulo r. 

16. (Amended) A method for improving the Nyberg-Rueppel signature scheme, 
said method comprising a signature generation method and a signature verification method, 
the said method [consisting in] having the step of including part of [the] a message of size t 
bytes in [the] an integer d, the signature being the pair of integers (c,d), t being a small 
integer, the t least significant bytes of the integer d containing t bytes of the message, [the] 
said method utilising a set having a group structure of order r r where r is a prime number 
[r], with a zero element denoted O and generating the point G, [the] and employing a 
private key [being] that is a positive integer s less than r and [the] a public key being the 
point W=s.G, [characterised in that] wherein the method of generating the signature of a 
message m using the integer parameters t, a and k includes the following seven steps: 
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1) Calculating h=H(m), H being a hash function; 

2) Removing the t least significant bytes and the k most significant bytes of the 
message m and storing the result in m' ; 

3) Storing [in] as f the result of the concatenation with m' of the a most 
significant bytes of h; 

4) Generating a random number u between 1 and r-1 and calculating V=u.G; 

5) Associating an integer i with the point V and calculating c=i+f modulo r; 
returning to step 4[)] if c=0; 

6) Calculating the integer d=u-s*c modulo r; if d is not equal to m modulo 2 8t 
returning to step 4[)]; and 

7) [The signature is] Utilizing the pair of integers (c,d) as the signature : 

and [in that] wherein the signature verification method includes the following seven steps: 

1) If c does not belong to the interval [l,r-l] or if d does not belong to the 
interval [0,r-l], the signature is not valid; 

2) Calculating the point P = d.G+c.W; if P=0, the signature is not valid; 

3) Associating the integer i with the point P; 

4) Calculating the integer f=c-i modulo r; 

5) Concatenating the t least significant bytes of d with the message m' obtained 
from f by removing the a least significant bytes; 

6) For b ranging from 0 to 2 8k -l, repeating the following step: 
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6[)]a) Concatenating the message m' with b in order to obtain m and calculating 
h=H(m); verifying that the a most significant bytes of h and the a least significant bytes of 
f are identical; if yes, the signature of the message m is valid and the method is terminated; 

7) Otherwise the [The] signature is not valid. 

17. (Amended) A method for generating and verifying an electronic signature 
according to [any one of the preceding claims, characterised in that] claim 1, wherein the 
operations are effected on an elliptic curve forming a group structure and having at least 
one point G, which is the generator of a sub-group of order [a prime number] r. 

18. (Amended) A method for generating and verifying an electronic signature 
according to [any one of the preceding claims, characterised in that] claim 1, wherein the 
operations are effected in the multiplicative group of the integers modulo a prime number 
P- 

19. (Amended) A method for generating and verifying an electronic signature 
according to [any one of the preceding claims, characterised in that] claim 1, wherein the 
operations are effected in a multiplicative sub-group of order [a prime number] r of the 
multiplicative group of the integers modulo a prime number p with r dividing p-1. 
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20. (Amended) An electronic device [according to any one of the preceding 
claims, characterised in that the device performing the test] that executes the method of 
claim 1 , wherein said device is a portable device. 

21. (Amended) An electronic device [according to any one of the preceding 
claims, characterised in] that executes the method of claim 1 , wherein the device is a smart 
card. 

22. (Amended) An electronic device [according to any one of the preceding 
claims, characterised in] that executes the method of claim 1 , wherein the device is a 
contactless card. 

23. (Amended) An electronic device [according to any one of the preceding 
claims, characterised in] that executes the method of claim 1. wherein the device is a 
PCMCIA card. 

24. (Amended) An electronic device [according to any one of the preceding 
claims, characterised in] that executes the method of claim 1 . wherein the device is a 
badge. 
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25. (Amended) An electronic device [according to any one of the preceding 
claims, characterised in] that executes the method of claim 1 . wherein the device is an 
intelligent watch. 
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SIGNATURE SCHEMES BASED__ON THE DISCRETE LOGARITHM WITH 
PARTIAL OR TOTAL RE CONSTITUTION OF THE MESSAGE 

The invention consists of two novel electronic 
signature schemes based on the discrete logarithm 
5 problem, the first allowing the total reconstitution of 
the message, the second allowing the partial 
reconstitution of the message, as well as two 
techniques for reducing the size of the electronic 
signatures . 

10 An electronic signature of a message is a number 

depending both on a secret key known only to the person 
signing the message, and the content of the message to 
be signed. An electronic signal must be verifiable: it 
must be possible for a third person to verify the 

15 validity of the signature, without knowledge of the 
secret key of the person signing the message being 
required. 
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There exist two types of electronic signature 
scheme : 

Electronic signature schemes requiring the 
original message for verification of the signature. 
5 - Electronic signature schemes with 

reconstitution of the message. The original message is 
obtained after the signature itself. Since the 

original message is not necessary for verifying the 
signature, the total size of the signature is shorter. 

10 There are many electronic signature methods. The 

best known are: 

RSA signature scheme: this is the most widely 
used electronic signature scheme. Its security is 
based on the difficulty of factorising large numbers; 

15 - Rabin signature scheme. Its security is also 

based on the difficulty of factorising large numbers; 

Signature scheme of the El-Gamal type. Its 
security is based on the difficulty of the discrete 
logarithm problem. The discrete logarithm problem 

20 consists in determining, if such exists, an integer x 
such that y=g x with y and g two elements of a set E 
having a group structure; 

Schnorr signature scheme. This is a variant 
of the signature scheme of the El-Gamal type. 

25 There exists another variant of the signature 

scheme of the El-Gamal type allowing the total 
reconstruction of the message, called the Nyberg and 
Rueppel signature scheme. This scheme is described in 
the article "A new signature scheme based on the DSA, 

3 0 giving message recovery" which appeared in "Proceedings 
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of the first ACM conference on communications and 
computer security, 1993, 58-61". A variant scheme 
based on the elliptic curve is described in the 
document "IEEE P1363 draft. Standard specifications 
5 for public key cryptography. August 1998." This 
variant uses a redundancy function R, an elliptic curve 
forming a group structure whose zero element is denoted 

0 and a point G on the curve, which point G is the 
generator of a sub-group of order a prime number r. 

10 The private key is a positive integer s smaller than r 
and the public key is the point W=s.G, the notation s.G 
designating the sum, in the sense of the addition of 
the elliptic curve, of s points taken to be equal to G. 
The method of generating the signature of a message m 

15 includes the following five steps: 

1) Generating a random number u between 0 and r- 

1 and calculating V=u.G; 

2) Calculating the integer f=R(m); 

3) Associating with the point V an integer i and 
20 calculating c=i+f modulo r; returning to step 1) if 

C=0 ; 

4) Calculating d=u-s*c modulo r; 

5) The signature is the pair of integers (c,d) . 
The method of verifying the signature includes the 

25 following four steps: 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [0,r-l] , the 
signature is not valid, - 

2) Calculating the point P=d.G+c.W; if P=0, the 
3 0 signature is not valid; 
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3) Associating the integer i with the point P 
and calculating the integer f=c-i modulo r; 

4) Finding the message m from f and verifying 
that f=R(m); if yes, the signature of the message m is 

5 valid; otherwise this signature is not valid. 

The first method of the invention consists of 
another variant of a signature scheme of the El-Gamal 
type. This variant allows the total reconstitut ion of 
the message. The variant is described in the context 
M io of the use of elliptic curves. It is however possible 

'% to use this variant in any set having a group structure 

:ff for which the discrete logarithm problem is difficult, 

m for example the multiplicative group of the integers 

modulo a prime number or the multiplicative sub-group 
T' 15 of order a large prime number r of the integers modulo 

a prime number p with r dividing p-1. This variant 
i4j uses a redundancy function R, an elliptic curve forming 

'■^} a group structure whose zero element is denoted O and a 

□ 

n\ point G on the curve, which point G is the generator of 

2 0 a sub-group of order a prime number r. The private key 
is a positive integer s less than r and the public key 
is the point W=s.G. This variant uses a non-zero 
integer constant k. The method of generating the 
signature includes the following four steps: 
2 5 1) Generating a random number u between 1 and r- 

1 and calculating V=u.G; 

2) Associating an integer i with the point V and 
calculating c=i+f modulo r,- if c=0, returning to 
step 1) ; 
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3) Calculating the integer d=u _1 * (k+s*c) modulo 
r; if d=0, returning to step 1) ; 

4) The signature is the pair of integers (c,d) . 
The corresponding method of verifying the 

5 signature includes the following six steps: 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [l,r-l], the 
signature is not valid; 

2) Calculating the integers h = d" 1 modulo r, 
10 hi=k*h modulo r and h 2 =c*h modulo r; 

3) Calculating the point P = h x G + h 2 W; if P=0, 
the signature is not valid; 

4) Associating an integer i with the point P; 

5) Calculating the integer f=c-i modulo r; 

15 6) Finding the message m from f and verifying 

that f=R(m); if yes, the signature of the message m is 

valid; otherwise the signature is valid. 

The previously described method therefore makes it 

possible to obtain an electronic signature scheme whose 
20 security is based on the difficulty of the discrete 

logarithm problem and allowing total reconstitut ion of 

the message. 

The invention also comprises a second electronic 
signature method allowing partial reconstruction of the 

25 message. The previously described signature scheme 
allows total reconst itution of the message. However, 
the total size of the message to be signed is limited 
by the size of the arguments of the redundancy function 
R. The second method of the invention makes it 

30 possible to sign a message of any size. The message m 
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to be signed is divided into two parts: the first part 
mi of constant size is reconstituted from the signature, 
the second part m 2 is transmitted with the signature of 
the message. The total size of the signature and of 
5 the message to be transmitted is therefore reduced by 
the size of the part m 1 . The signature scheme is 
described in the context of the use of elliptic curves. 
It is however possible to use this scheme in any set 
having a group structure for which the discrete 

10 logarithm problem is difficult, for example the 
multiplicative group of integers modulo a prime number 
or the multiplicative sub-group of order a large prime 
number r of the integers modulo a prime number p with r 
dividing p-1. The signature scheme utilises a 

15 redundancy function r, an elliptic curve forming a 
group structure in which the element zero is denoted O 
and a point G on the curve, which point G is the 
generator of a sub-group of order a prime number r. 
The private key is a positive integer s less than r and 

20 the public key is the point W=s.G. The method of 
generating the signature of a message m consisting of 
the messages mi and m 2 includes the following six steps: 

1) Generating a random integer u between 1 and 
r-1 and calculating V=u.G; 

25 2) Calculating f 1= R(mi); 

3) Associating an integer i with the point V and 
calculating c=i+fi modulo r; if c=0, returning to 
s t ep 1 ; 

4) Calculating f 2 =H(m 2 ), where H is a hash 
3 0 function; 
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5) Calculating the integer d=u _1 * (f 2 + s*c) modulo 
r; if d=0, returning to step 1 ; 

6) The signature is the pair of integers (c,d) . 
The method for verifying the signature takes as an 

5 input a pair of integers (c,d) and the partial message 
m 2 and comprises the following seven steps: 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [l,r-l], the 
signature is not valid; 
10 2) Calculating f 2 =H(m 2 ), where H is a hash 

function; 

3) Calculating the integers h=d _1 modulo r, 
h! = f 2 *h modulo r and h 2 =c*h modulo r; 

4) Calculating the point P=hiG+h 2 W; if P=0, the 
15 signature is not valid; 

5) Associating the integer i with the point P; 

6) Calculating the integer f^c-i modulo r; 

7) Obtaining the message mi from f x and verifying 
that fi=R(mi) ; if yes, the signature of the message m is 

20 valid; otherwise the signature is not valid. 

The previously described method therefore makes it 
possible to obtain an electronic signature scheme whose 
security is based on the difficulty of the discrete 
logarithm and allowing partial reconstruction of the 

25 message. The advantage of such a scheme is to reduce 
the total size of the signature and of the message to 
be transmitted without however imposing a size 
constraint on this message. 

The invention also consists of two general 

30 techniques for minimising the total size of the 



signature and of the message to be transmitted. The 
first technique consists in including part of the 
message inside the signature whilst suitably choosing 
the random data used during the generation of the 
5 signature. The second technique consists in 

eliminating some of the bytes representing the 
signature, the complete reconst itution of the signature 
taking place during the verification phase. 

The third method of the invention consists of an 

10 improvement to the Nyberg-Rueppel signature scheme 
mentioned previously, and consists in including part of 
the message of size t bytes in the integer d defined 
previously, t being a small integer. In this method, 
the t least significant bytes of the integer g contain 

15 t bytes of the message. The third method of the 
invention therefore makes it possible to increase the 
size of the message to be signed by t bytes compared 
with the Nyberg-Rueppel signature scheme described 
previously. The third method uses a redundancy 

20 function R, an elliptic curve forming a group structure 
in which the zero element is denoted 0 and a point G on 
the curve, which point G is the generator of a sub- 
group of order a prime number r. The private key is a 
positive integer s less than r and the public key is 

25 the point W=s.G. The method of generating the 

signature of a message m includes the following five 
steps : 

1) Removing the t least significant bytes of the 
message m and storing the result in m' ; calculating 
3 0 f=R(m' ) ; 
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2) Generating a random number u between 1 and r- 
1 and calculating V=u.G; 

3) Associating an integer i with the point V and 
calculating c=i+f modulo r; returning to step 1) if 
c=0 . 

4) Calculating the integer d=u-s*c modulo r; if 
d is not equal to m modulo 2 8t , returning to step 2) ; 

5) The signature is the pair of integers (c,d) . 
The method for verifying the signature includes 

the following five steps: 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [0,r-l], the 
signature is not valid; 

2) Calculating the point P=d.G+c.W; if P=0, the 
signature is not valid; 

3) Associating the integer i with the point P; 

4) Calculating the integer f=c-i modulo r; 

5) Obtaining the message m' from f and verifying 
that f=R(m' ); if such is not the case, the signature is 
not valid; if such is the case, the signature is valid 
and the message m is the concatenation to the message 
m' of the t least significant bytes of the integer d. 

It is possible to effect a preprocessing of the 
data making it possible to accelerate the generation of 
the signature according to the signature scheme 
described previously. The pretreatment method takes as 
an input the secret key s and consists in putting in 
memory in a table a large number of values (i, x u ) with 
x u =u-s*i modulo r and i being the integer associated 
with the point V=u.G, so that the values can be 
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accessed by the remainder of x u modulo 2 8t . The 
signature generation method with pretreatment of the 
data uses a redundancy function R, an elliptic curve 
forming a group structure in which the zero element is 
5 denoted 0 and a point G on the curve, which point G is 
the generator of a sub-group of order a prime number r. 
The private key is a positive integer s less than r and 
the public key is the point W=s.G. 

The signature generation method with preprocessing 

10 of the data includes the following eight steps: 

1) Removing the t least significant bytes in the 
message m and storing the result in the message m' ; 
calculating f=R(m'). The t least significant bytes of 
the message m are stored in the integer 5; 

15 2) Calculating the integer y=s*f modulo r and 

the integer A,=y modulo 2 8t ; 

3) If y<r/2, first of all executing step 4 and 
next step 5; otherwise executing first of all step 5 
and next step 4; 

20 4) Accessing the elements of the table where the 

remainder modulo 2 8t is ^+8 modulo 2 8t and selecting an 
element such that x u is greater than or equal to y; if 
such an element exists, it is eliminated from the table 
and the method passes to step 6) ; 

2 5 5) Accessing the elements of the table where the 

remainder modulo 2 8t is ^+5+r modulo 2 8t and selecting an 
element such that x u is less than y; if such an element 
exists, it is eliminated from the table and the method 
passes to step 6) ; 
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6) Calculating the integer d=x u -y modulo r; 

7) Obtaining the integer i associated with x u and 
calculating c=i+f modulo r; 

8) The signature is the pair of integers (c,d) . 

5 The fourth method of the invention consists of an 

improvement to the signature scheme based on the 
discrete logarithm with partial reconstitut ion of the 
message described previously. The fourth method of the 
invention consists in including part of the message of 

10 size t bytes in the integer d defined previously, t 
being a small integer. In this method, the t least 
significant bytes of the integer d contain t bytes of 
the message. The fourth method of the invention 
therefore makes it possible to reduce by t bytes the 

15 total size of the signature and of the message to be 
transmitted. The signature scheme uses a redundancy 
function R, an elliptic curve forming a group structure 
in which the zero element is denoted O and a point G on 
the curve, which point G is the generator of a sub- 

2 0 group of order a prime number r. The private key is a 
positive integer s less than r and the public key is 
the point W=s.G. The method of generating the 

signature of a message m consisting of the messages mi 
and m 2 includes the following six steps: 

2 5 1) Generating a random integer u between 1 and 

r-1 and calculating V=u.G; 

2) Calculating f 1 =R(m 1 ); 

3) Associating an integer i with the point V and 
calculating c=i+fi modulo r; if c=0, returning to 

3 0 step 1; 
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4) Calculating f 2 =H(m 2 ), where H is a hash 
function; 

5) Calculating the integer d=u" 1 * ( f 2 +s*c) modulo 
r; if d=0 or if d is not equal to m 2 modulo 2 8t , 

5 returning to step 1 ; 

6) The signature is the pair of integers (c,d) 
and the message to be transmitted is m' 2 consisting of 
m 2 deprived of its t least significant bytes. 

The signature verification method takes as an 
10 input a pair of integers (c,d) and the partial message 
m' 2 and comprises the following eight steps: 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [l,r-l], the 
signature is not valid; 
15 2) Making up m' 2 as m 2 by adding to it the t 

least significant bytes of d; 

3) Calculating f 2 =H(m 2 ), where H is a hash 
function; 

4) Calculating the integers h=d _1 modulo r, 
20 hi=f 2 *h modulo r and h 2 = c*h modulo r; 

5) Calculating the point P=h!G+h 2 W; if P=0 the 
signature is not valid; 

6) Associating the integer i with the point P; 

7) Calculating the integer fi=c-i modulo r; 

25 8) Obtaining the message mi from fi and verifying 

that f 1 =R(m 1 ); if yes, the signature of the message m is 
valid; otherwise the signature is not valid. 

The fifth method of the invention consists in 
eliminating t bytes from the chain of bytes 

3 0 representing the integer d when the signature is the 
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pair of integers (c,d) . This method applies to the 
Nyberg and Rueppel signature scheme and to the 
signature scheme with partial reconstruction of the 
message described previously. The modified signature 
5 generation method includes the following two steps: 

1) Generating the signature of the message m 
using the Nyberg and Rueppel signature scheme or the 
signature scheme with partial reconstruction of the 
message described previously, in order to obtain the 

g 10 pair of integers (c,d); 

2) Calculating d' , the integer quotient of the 
m division of the integer d by 2 8t . The signature is the 

pair of integers (c,d'). 
}jf The modified signature verification method takes 

^ 15 as an input a pair (c,d') and a message m 2 and includes 

£ the following two steps in the case of the signature 

!}* scheme with partial reconstitution of the message 

O described previously: 

Sfe " 1) For i ranging from 0 to 2 8t -l, calculating the 

20 integer d=d' *2 8t +i and executing the signature 
verification method with partial reconstitution of the 
message described previously, the signature to be 
verified being (c,d); if the signature verification 
method recognises the signature (c,d) as valid, the 
25 signature is valid and the method is terminated; 

2) If step 1) has not succeeded, the signature 
is not valid. 

In the case of the use of the Nyberg-Rueppel 
signature scheme, the signature verification method 
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takes as an input a pair (c,d') and includes the 
following five steps: 

1) If c does not belong to the interval [l,r-l], 
the signature is not valid; 

2) Calculating the point P=d' *2 8t .G+c .W; 

3) For j ranging from 0 to 2 8t -l, executing the 
following steps: 

3)a)If P=0, executing step 3)d); 

3 ) b) Associating the integer i with the point P 
and calculating the integer f=c-i modulo r; 

3) c) Finding the message m from f and verifying 
that f=R(m); if yes, executing step 5) ; 

3) d) Replacing P with P+G; 

4) The signature is not valid and the method is 
terminated; 

5) If the integer d=d' *2 8t +j does not belong to 
the interval [0,r-l], the signature is not valid; 
otherwise the signature is valid and the method is 
terminated. 

The sixth method of the invention consists of a 
modification of the Nyberg and Rueppel signature scheme 
making it possible to increase the messages to be 
signed by t bytes, t being an integer variable. The 
sixth method utilises a redundancy function R, an 
elliptic curve forming a group structure in which the 
zero element is denoted 0 and the point G on the curve, 
which point G is the generator of a sub-group of order 
a prime number r. The private key is a positive 
integer s less than r and the public key is the point 
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W=s.G. The method of generating the signature of a 
message m includes the following five steps: 

1) Generating a random number u and calculating 

v=u . G ; 

5 2) Obtaining the message m' by removing from the 

message m the t least significant bytes and calculating 
f=R(m' ) ,- 

3) Associating an integer i with the point V and 
calculating c=i+f modulo r; returning to step 1) if c=0 

10 and if i is not equal to m modulo 2 8t ; 

4) Calculating d=u-s*c modulo r; 

5) The signature is the pair of integers (c,d). 
The signature verification method includes the 

following four steps: 
15 1) If c does not belong to the interval [l,r-l] 

or if d does not belong to the interval [0,r-l], the 
signature is not valid; 

2) Calculating the point P=d.G+c.W; if P=0, the 
signature is not valid; 

20 3) Associating the integer i with the point P 

and calculating the integer f=c-i modulo r; 

4) Finding the message m' from f and verifying 
that f=R(m'); if yes, finding the message m by 
concatenating the t least significant bytes of i with 

25 the message m' . The signature of the message m is then 
valid; otherwise the signature is not valid. 

The seventh method of the invention consists of a 
modification of the signature scheme with partial 
reconstitution of the message described previously 

30 making it possible to increase by t bytes the size of 
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the message vcix reconstituted from the signature, t being 
an integer variable. The seventh method uses a 

redundancy function R, an elliptic curve forming a 
group structure in which the zero element is denoted 0 
5 and a point G on the curve, which point G is the 
generator of a sub-group of order a prime number r. 
The private key is a positive integer s less than r and 
the public key is the point W=s.G. The method of 
generating the signature of a message m, consisting of 
10 two messages mi and m 2 , includes the following six 
steps : 

1) Generating a random integer u between 1 and 
r-1 and calculating V=u.G; 

2) Obtaining rn'i by removing the t least 
15 significant bytes from the message mi. Calculating 

fi=R(m'!) ; 

3) Associating an integer i with the point V and 
calculating c=i+f x modulo r; if c=0 or if i is not equal 
to m x modulo 2 8t , returning to step 1; 

20 4) Calculating f2=H(m 2 ), where H is a hash 

function; 

5) Calculating the integer d=u _1 * (f 2 +s*c) modulo 
r; if d=0, returning to step 1 ; 

6) The signature is the pair of integers (c,d) . 
25 The signature verification method takes as an 

input a pair of integers (c,d) and the partial message 
m 2 and comprises the following seven steps: 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [l,r-l], the 
3 0 signature is not valid; 
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2) Calculating f 2 =H(m 2 ), where H is a hash 
function; 

3) Calculating the integers h=d _1 modulo r, 
hi=f 2 *h modulo r and h 2 = c*h modulo r; 

5 4) Calculating the point P=hiG+h 2 W; if P=0, this 

signature is not valid. 

5) Associating the integer i with the point P; 

6) Calculating the integer fi=c-i modulo r; 

7) Obtaining the message m'i from fi and 
10 verifying that fi=R(m'i); if yes, obtaining mi by 

concatenating the t least significant bytes of the 
integer i with the message m'i. The signature of the 
message m is then valid; otherwise the signature is not 
valid . 

15 It is possible, for the sixth and seventh methods, 

to reduce the calculation time by effecting 
preprocessing. Such preprocessing consists in putting 
in memory in a table pairs of integers (u,i) as defined 
previously so that these integers are accessible 

20 through the value of i modulo 2 8t . 

The eighth method of the invention consists of a 
modification of the Nyberg and Rueppel signature scheme 
consisting in removing t bytes from the integer c 
previously defined, t being an integer variable. The 

25 signature generation method includes the following two 
steps : 

1) Generating the signature of the message m 
using the Nyberg-Rueppel signature scheme in order to 
obtain the pair of integers (c,d); 
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2) Calculating c' , the integer quotient of the 
division of the integer c by 2 8c . The signature is the 
pair of integers (c',d) . 

The signature verification method takes as an 
5 input the pair of integers (c',d) and includes the 
following five steps: 

1) If d does not belong to the interval [0,r-l], 
the signature is not valid; 

2) Calculating the point P=d. G+c ' *2 8t . W; 

10 3) For j ranging from 0 to 2 8t -l, executing the 

following steps: 

3) a)If P=0, executing step 3)d); 

3) b) Associating the integer i with the point P 
and calculating the integer f=c-i modulo r; 
15 3) c) Finding the message m from f and verifying 

that f=R(m); if yes, executing step 5) ; 

3) d) Replacing P by P+W; 

4) The signature is not valid and the method is 
terminated; 

20 5) If the integer c=c'*2 8t +j does not belong to 

the interval [l,r-l], the signature is not valid; 
otherwise the signature is valid and the method is 
terminated. 

The ninth method of the invention is a 
25 modification of the signature scheme with partial 
reconstitution of the message defined previously, which 
consists in removing t bytes from the integer c defined 
previously, t being an integer variable. The signature 
generation method comprises the following two steps: 
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1) Generating the signature of the message m, 
consisting of two messages rtii and m 2 , using the 
signature scheme with partial reconstitution of the 
message in order to obtain the pair of integers (c,d) ; 
5 2) Calculating c' , the integer quotient of the 

division of the integer c by 2 8t . The signature is the 
pair of integers (c',d). 

The signature verification method takes as an 
input a pair of integers (c',d) and a message m 2 and 
10 comprises the following eight steps: 

1) If d does not belong to the interval [l,r-l], 
the signature is not valid; 

2) Calculating f 2 =H(m 2 ) , where H is a hash 
function ; 

15 3) Calculating the integers h=d _1 modulo r, 

hi=f 2 *h modulo r and h 2 = c'*2 8t *h modulo r; 

4) Calculating the point P=hi .G+h 2 .W; 

5) Calculating the point Z=h.W; 

6) For j ranging from 0 to 2 8t -l, executing the 
20 following steps: 

6) a) If P=0, executing step 6)d); 

6) b) Associating the integer i with the point P 
and calculating the integer f L =c-i modulo r; 

6) c) Finding the message mi from f x and verifying 
25 that fi=R(m 1 ); if yes, executing step 8) ; 

6) d) Replacing P with P+Z; 

7) The signature is not valid and the method is 
terminated; 

8) If the integer c = c'*2 8t + j does not belong to 
30 the interval [l,r-l], the signature is not valid; 
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otherwise the signature is valid and the method is 
terminated. 

The tenth method of the invention consists of a 
modification of the signature scheme with partial 
5 reconstitution of the message previously described, 
which consists in replacing the signature (c,d) with 
the signature (h 2 ,d) with h 2 =c*d -1 modulo r. The 
advantage of this tenth method is to allow a reduction 
in calculation time when this method is applied to any 

10 one of the previously defined methods. 

The eleventh method of the invention consists of 
an improvement to the Nyberg-Rueppel signature scheme 
given previously, and consists in including part of the 
message of size t bytes in the integer d defined 

15 previously, t being a small integer, and using another 
redundancy function. In this method, the t least 
significant bytes of the integer d contain t bytes of 
the message. The eleventh method uses an elliptic 
curve forming a group structure in which the zero 

2 0 element is denoted O and a point G on the curve, which 

point G is the generator of a sub-group of order a 
prime number r. The private key is a positive integer 
s less than r and the public key is the point W=s.G. 
The method of generating the signature of a message m 
25 uses the integer parameters t, a and k and includes the 
following seven steps: 

1) Calculating h=H (m) , H being a hash function; 

2) Removing the t least significant bytes and 
the k most significant bytes of the message m and 

3 0 storing the result in m' ; 
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3) Storing in f the result of the concatenation 
with m' of the a most significant bytes of h; 

4) Generating a random number u between 1 and r- 
1 and calculating V=u.G; 

5 5) Associating an integer i with the point V and 

calculating c=i+f modulo r; returning to step 4) if 
c = 0; 

6) Calculating the integer d=u-s*c modulo r; if 
d is not equal to m modulo 2 8t returning to step 4) ; 
10 7) The signature is the pair of integers (c,d) . 

The signature verification method includes the 
following seven steps: 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [0,r-l], the 

15 signature is not valid; 

2) Calculating the point P=d.G+c.W; if P=0, the 
signature is not valid; 

3) Associating the integer i with the point P; 

4) Calculating the integer f=c-i modulo r; 

20 5) Concatenating the t least significant bytes 

of d with the message m' obtained from f by removing 
the a least significant bytes; 

6) For b ranging from 0 to 2 8k -l, repeating the 
following step: 

25 6) a) Concatenating the message m' with b in order 

to obtain m and calculating h=H (m) ,- verifying that the 
a most significant bytes of h and the a least 
significant bytes of f are identical; if yes, the 
signature of the message m is valid and the method is 

3 0 terminated; 
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7) The signature is not valid. 

The methods described therefore make it possible 
to significantly reduce the total size of the signature 
and of the message to be transmitted. When the memory 
5 space is limited, it is thus possible to store a larger 
number of signatures. In addition, it is also possible 
to effect a more rapid transmission of the signatures. 
These methods are particularly intended to be set up in 
portable devices, for example of the smart card type. 
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CLAIMS 

1. An electronic signature method comprising a 
generation method and a verification method allowing 
total reconstitution of the message, the said method 
5 utilising a redundancy function R, a set having a group 
structure of order a prime number r, with a zero 
element denoted 0 and generating the point G, the 
private key being a positive integer less than r, the 
public key being the point W=s.G, the said method using 
10 a non-zero integer constant k, characterised in that 
the signature generation method includes the following 
four steps: 

1) Generating a random number u between 1 and r- 
1 and calculating V=u.G; 
15 2) Associating an integer i with the point V and 

calculating c=i+f modulo r; if c=0, returning to 
step 1) ; 

3) Calculating the integer d=u _1 * (k+s*c) modulo 
r; if d=0, returning to step 1) ; 
20 4) The signature is the pair of integers (c,d); 

and in that the signature verification method 
includes the following six steps: 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [l,r-l], the 

25 signature is not valid; 

2) Calculating the integers h = d" 1 modulo r, 
hi=k*h modulo r and h 2 =c*h modulo r; 

3) Calculating the point P = hiG + h 2 W; if P=0, 
the signature is not valid; 
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4) Associating an integer i with the point P; 

5) Calculating the integer f=c-i modulo r; 

6) Finding the message m from f and verifying 
that f=R(m); if yes, the signature of the message m is 

5 valid; otherwise the signature is valid. 

2. An electronic signature method comprising a 
generation method and a signature verification method 
allowing partial reconstruction of the message, the 
message m to be signed being divided into two parts, 

10 the first part mi of constant size being reconstituted 
from the signature, the second part m 2 being transmitted 
with the signature of the method, the said method 
utilising a redundancy function R, a set having a group 
structure of order a prime number r, with a zero 

15 element denoted O and generating the point G, the 
private key being a positive integer less than r and 
the public key being the point W=s.G, characterised in 
that the method of generating the signature of a 
message m consisting of the messages m x and m 2 includes 

20 the following six steps: 

1) Generating a random integer u between 1 and 
r-1 and calculating V=u.G; 

2) Calculating fi=R(mi); 

3) Associating an integer i with the point V and 
25 calculating c=i+fi modulo r; if c=0, returning to 

step 1; 

4) Calculating f 2 =H(m 2 ), where H is a hash 
function; 

5) Calculating the integer d=u _1 * (f 2 +s*c) modulo 
30 r; if d=0, returning to step 1; 
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6) The signature is the pair of integers (c,d); 

and in that the signature verification method 
takes as an input a pair of integers (c,d) and the 
partial message m 2 and comprises the following seven 
5 steps: 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [l,r-l], the 
signature is not valid; 

2) Calculating f 2 =H(m 2 ), where H is a hash 
10 function; 

3) Calculating the integers h=d _1 modulo r, 
hx=f 2 *h modulo r and h 2 = c*h modulo r; 

4) Calculating the point P=hiG+h 2 W; if P=0, the 
signature is not valid ; 

15 5) Associating the integer i with the point P; 

6) Calculating the integer fi=c-i modulo r; 

7) Obtaining the message m x from f 1 and verifying 
that fi=R(mi); if yes, the signature of the message m is 
valid; otherwise the signature is not valid. 

20 3. An electronic signature method comprising a 

generation method and a signature verification method 
characterised in that it consists in including part of 
the message inside the signature by suitably choosing 
the random data used during the generation of the 

2 5 signature. 

4. An electronic signature method comprising a 
generation method and a signature verification method, 
characterised in that it consists in eliminating some 
of the bytes representing the signature, the complete 
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reconstitution of the signature taking place during the 
verification phase. 

5 . A method for improving the Nyberg-Rueppel 
signature scheme according to Claim 3, comprising a 
5 generation method and a verification method and 
consisting in including part of the message of size t 
bytes in the integer d, t being a small integer, the 
signature being the pair of integers (c,d), the t least 
significant bytes of the integer g containing t bytes 

10 of the message, the said method using a redundancy 
function R, a set having a group structure of order a 
prime number r, with a zero element denoted 0 and 
generating the point G, the private key being a 
positive integer s less than r and the public key being 

15 the point W=s.G, characterised in that the method of 
generating the signature of a message m includes the 
following five steps: 

1) Removing the t least significant bytes of the 
message m and storing the result in m' ,- calculating 

20 f=R(m' ) ; 

2) Generating a random number u between 1 and r- 
1 and calculating V=u.G; 

3) Associating an integer i with the point V and 
calculating c=i+f modulo r; returning to step 1) if 

25 c=0. 

4) Calculating the integer d=u-s*c modulo r; if 
d is not equal to m modulo 2 8t , returning to step 2) ; 

5) The signature is the pair of integers (c,d) ; 
and in that the signature verification method 

30 includes the following five steps: 
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1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [0,r-l] f the 
signature is not valid; 

2) Calculating the point P=d.G+c.W; if P=0, the 
5 signature is not valid; 

3) Associating the integer i with the point P; 

4) Calculating the integer f=c-i modulo r; 

5) Obtaining the message m' from f and verifying 
that f=R(m') ; if such is not the case, the signature is 

10 not valid; if such is the case, the signature is valid 
and the message m is the concatenation with the message 
m' of the t least significant bytes of the integer d. 

6. A method for the preprocessing of the 
signature generation according to Claim 5, making it 

15 possible to accelerate the generation of the 
signatures, the said method comprising a pretreatment 
phase and a signature generation phase, the said 
pretreatment phase taking as an input the secret key s 
and consisting in putting in memory in a table a large 

20 number of values (i, x u ) with x u =u-s*i modulo r and i 
being the integer associated with the point V=u.G, so 
that these values can be accessed by the remainder of x u 
modulo 2 8t , the said signature generation phase 
utilising a redundancy function R, a set having a group 

25 structure of order a prime number r, with a zero 
element denoted 0 and generating the point G, the 
private key being a positive integer s less than r and 
the public key being the point W=s.G, the said 
signature generation phase being characterised by the 

30 following eight steps: 
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1) Removing the t least significant bytes in the 
message m and storing the result in the message m' ; 
calculating f=R(m'). The t least significant bytes of 
the message m are stored in the integer 8; 
5 2) Calculating the integer y=s*f modulo r and 

the integer X=y modulo 2 8t ; 

3) If y<r/2, first of all executing step 4 and 
next step 5; otherwise executing first of all step 5 
and next step 4; 

10 4) Accessing the elements of the table where the 

remainder modulo 2 8t is X+8 modulo 2 8t and selecting an 
element such that x u is greater than or equal to y; if 
such an element exists, it is eliminated from the table 
and the method passes to step 6) ; 

15 5) Accessing the elements of the table where the 

remainder modulo 2 8t is X+5+r modulo 2 8t and selecting an 
element such that x u is less than y; if such an element 
exists, it is eliminated from the table and the method 
passes to step 6) ; 

2 0 6) Calculating the integer d=x u -y modulo r; 

7) Obtaining the integer i associated with x u and 
calculating c=i+f modulo r; 

8) The signature is the pair of integers (c,d) . 

7. A method for improving the signature scheme 
25 with partial reconstitution of the message according to 
Claim 2, the said method comprising a signature 
generation method and a signature verification method, 
the said method consisting in including part of the 
message of size t bytes in the integer d defined 
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previously, t being a small integer, the t least 
significant bytes of the integer d containing t bytes 
of the message, the said method utilising a redundancy 
function R, a set having a group structure of order a 
5 prime number r, with a zero element denoted 0 and 
generating a point G, the private key being a positive 
integer less than r and the public key being the point 
W=s.G, characterised in that the method of generating 
the signature of a message m consisting of the messages 
10 mi and m 2 includes the following six steps: 

1) Generating a random integer u between 1 and 
r-1 and calculating V=u.G; 

2) Calculating f 1 =R(m 1 ); 

3) Associating an integer i with the point V and 
15 calculating c=i+fi modulo r; if c=0, returning to 

step 1; 

4) Calculating f 2 =H(m 2 ), where H is a hash 
function; 

5) Calculating the integer d=u _1 * (f 2 +s*c) modulo 
20 r; if d=0 or if d is not equal to m 2 modulo 2 8t , 

returning to step 1; 

6) The signature is the pair of integers (c,d) 
and the message to be transmitted is m' 2 consisting of 
m 2 deprived of its t least significant bytes; 

25 and in that the signature verification method 

takes as an input a pair of integers (c,d) and the 
partial message m' 2 and comprises the following eight 
steps : 
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1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [l,r-l], the 
signature is not valid; 

2) Making up m' 2 as m 2 by adding to it the t 
least significant bytes of d; 

3) Calculating f 2 =H(m 2 ), where H is a hash 
function; 

4) Calculating the integers h=d _1 modulo r, 
h 1 =f 2 *h modulo r and h 2 =c*h modulo r; 

5) Calculating the point P=h;iG+h 2 W; if P=0 the 
signature is not valid; 

6) Associating the integer i with the point P; 

7) Calculating the integer fi=c-i modulo r; 

8) Obtaining the message mi from f x and verifying 
that f 1 =R(m 1 ); if yes, the signature of the message m is 
valid; otherwise the signature is not valid. 

8. A method consisting in removing t bytes from 
the chain of bytes representing the integer d when the 
signature is the pair of integers (c,d) , the said 
method comprising a signature generation method and a 
signature verification method, the said method being 
applied to the Nyberg and Rueppel signature scheme, 
characterised in that the modified signature generation 
method includes the following two steps: 

1) Generating the signature of the message m 
using the Nyberg and Rueppel signature scheme, to 
obtain the pair of integers (c,d); 

2) Calculating d' , the integer quotient of the 
division of the integer d by 2 8t ; the signature is the 
pair of integers (c,d'); 
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and in that the modified signature verification 
method takes as an input a pair (c,d') and includes the 
following five steps: 

1) If c does not belong to the interval [l,r-l], 
5 the signature is not valid; 

2) Calculating the point P=d' *2 8t . G+c . W; 

3) For j ranging from 0 to 2 8t -l, executing the 
following steps: 

3)a)If P=0, executing step 3)d); 
10 3 ) b) Associating the integer i with the point P 

and calculating the integer f=c-i modulo r; 

3) c) Finding the message m from f and verifying 
that f=R(m); if yes, executing step 5) ; 
3) d) Replacing P with P+G; 
15 4) The signature is not valid and the method is 

terminated ; 

5) If the integer d=d'*2 8t +j does not belong to 
the interval [0,r-l], the signature is not valid; 
otherwise the signature is valid and the method is 

2 0 terminated. 

9. A method consisting in removing t bytes from 
the chain of bytes representing the integer d when the 
signature is the pair of integers (c,d) , the said 
method comprising a signature generation method and a 

25 signature verification method, the said method to the 
signature diagram with partial reconstitution of the 
message according to Claim 2, characterised in that the 
modified signature generation method includes the 
following two steps: 
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1) Generating the signature of the message m 
using the signature scheme with partial reconstruction 
of the message previously described, in order to obtain 
the pair of integers (c,d) ; 

2) Calculating d' , the integer quotient of the 
division of the integer d by 2 8t ; the signature is the 
pair of integers (c,d'); 

and in that the modified signature verification 
method takes as an input a pair (c,d') and a message m 2 
and includes the following two steps: 

1) For i ranging from 0 to 2 8t -l / calculating the 
integer d=d' *2 8t +i and executing the signature 
verification method with partial reconst itution of the 
message previously described, the signature to be 
verified being (c,d); if the signature verification 
method recognises the signature (c,d) as valid, the 
signature is valid, and the method is terminated; 

2) The signature is not valid. 

10. A method for improving the Nyberg and Rueppel 
scheme making it possible to increase the size of the 
messages to be signed by t bytes, t being an integer 
variable, the said method comprising a signature 
generation method and a signature verification method, 
the said method utilising a redundancy function R, a 
set having a group structure of order a prime number r, 
with a zero element denoted O and generating the point 
G, the private key being a positive integer s less than 
r and the public key being the point W=s.G, 
characterised in that the method of generating the 
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signature of a message m includes the following five 
steps : 

1) Generating a random number u and calculating 

V=u.G; 

5 2) Obtaining the message m' by removing from the 

message m the t least significant bytes and calculating 
f=R(m' ) ; 

3) Associating an integer i with the point V and 
calculating c=i+f modulo r; returning to step 1) if c=0 

10 and if i is not equal to m modulo 2 8t ; 

4) Calculating d=u-s*c modulo r; 

5) The signature is the pair of integers (c,d); 
and in that the signature verification method 

includes the following four steps: 
15 1) If c does not belong to the interval [l,r-l] 

or if d does not belong to the interval [0,r-l], the 
signature is not valid; 

2) Calculating the point P=d.G+c.W; if P=0, the 
signature is not valid; 

20 3) Associating the integer i with the point P 

and calculating the integer f=c-i modulo r; 

4) Finding the message m' from f and verifying 
that f=R(m'); if yes, finding the message m by 
concatenating the t least significant bytes of i with 

25 the message m' . The signature of the message m is then 
valid; otherwise the signature is not valid. 

11. A method for improving the signature scheme 
with partial reconst itut ion of the message according to 
Claim 2, the said method comprising a signature 

3 0 generation method and a signature verification method, 
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the said method making it possible to increase by t 
bytes the size of the message mi reconstituted from the 
signature, t being an integer variable, said method 
utilising a redundancy function R, a set having a group 
5 structure of order a prime number r, with a zero 
element denoted 0 and generating the point G, the 
private key being a positive integer less than r and 
the public key being the point W=s.G, characterised in 
that the method of generating the signature of a 
10 message m includes the following six steps: 

1) Generating a random integer u between 1 and 
r-1 and calculating V=u.G; 

2) Obtaining rn'i by removing the t least 
significant bytes from the message mi. Calculating 

15 f 1 =R(m' 1 ); 

3) Associating an integer i with the point V and 
calculating c=i+fi modulo r; if c=0 or if i is not equal 
to mi modulo 2 8t , returning to step 1; 

4) Calculating f 2 =H(m 2 ), where H is a hash 
20 function; 

5) Calculating the integer d=u _1 * (f 2 + s*c) modulo 
r; if d=0, returning to step 1 ; 

6) The signature is the pair of integers (c,d) ; 
and in that the signature verification method 

25 takes as an input a pair of integers (c,d) and the 
partial message m 2 and comprises the following seven 
steps : 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [l,r-l] , the 
30 signature is not valid; 



35 



2) Calculating f 2 =H(m 2 ), where H is a hash 
function; 

3) Calculating the integers h=d _1 modulo r, 
h 1 =f 2 *h modulo r and h 2 = c*h modulo r; 

5 4) Calculating the point P=hiG+h 2 W; if P=0, this 

signature is not valid. 

5) Associating the integer i with the point P; 

6) Calculating the integer f x =c-i modulo r; 

7) Obtaining the message m' i from f x and 
10 verifying that fi=R(m'i); if yes, obtaining mi by 

concatenating the t least significant bytes of the 
integer i with the message m'i. The signature of the 
message m is then valid; otherwise the signature is not 
valid. 

15 12 . A method for preprocessing the calculations 

making it possible to increase the performances of the 
methods according to Claims 10 and 11, characterised in 
that it consists in putting in memory in a table pairs 
of integers (u,i) as defined previously so that these 

20 integers are accessible to the value of i modulo 2 8t , t 
being an integer parameter. 

13 . A method for improving the Nyberg and Rueppel 
signature scheme consisting in removing t bytes from 
the integer c, t being an integer variable, the said 

25 method comprising a signature generation method and a 
signature verification method, the signature consisting 
of the pair of integers (c,d), characterised in that 
the signature generation method includes the following 
two steps : 
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1) Generating the signature of the message m 
using the Nyberg-Rueppel signature scheme in order to 
obtain the pair of integers (c,d) ; 

2) Calculating c' , the integer quotient of the 
5 division of the integer c by 2 8t . The signature is the 

pair of integers (c' ,d) ; 

and in that the signature verification method 
takes as an input the pair of integers (c',d) and 
includes the following five steps: 

l= * 10 1) If d does not belong to the interval [0,r-l], 

U 

Q the signature is not valid; 

;j 2) Calculating the point P=d . G+c ' *2 8t . W; 

jlj 3) For j ranging from 0 to 2 8t -l, executing the 

following steps: 
■= 15 3)a)If P=0, executing step 3)d); 

'% 3) b) Associating the integer i with the point P 

ill and calculating the integer f = c-i modulo r; 

'.ZJ. 3) c) Finding the message m from f and verifying 

TO that f=R(m) ; if yes, executing step 5) ; 

20 3) d) Replacing P by P+W; 

4) The signature is not valid and the method is 
terminated; 

5) If the integer c=c'*2 8t +j does not belong to 
the interval [l,r-l], the signature is not valid; 

25 otherwise the signature is valid and the method is 
terminated . 

14. A method for improving the signature scheme 
with partial reconstitution of the message according to 
Claim 2, consisting in removing t bytes from the 
30 integer c defined according to Claim 2, t being an 



integer variable, the said method comprising a 
signature generation method and a signature 
verification method, characterised in that the 
signature generation method comprises the following two 
steps : 

1) Generating the signature of the message m, 
using the signature scheme with partial reconstitution 
of the message in order to obtain the pair of integers 
(c,d) ,- 

2) Calculating c' , the integer quotient of the 
division of the integer c by 2 8t ; the signature is the 
pair of integers (c',d); 

and in that the signature verification method 
takes as an input a pair of integers (c',d) and a 
message m 2 and comprises the following eight steps: 

1) If d does not belong to the interval [l,r-l], 
the signature is not valid; 

2) Calculating f 2 =H(m 2 ), where H is a hash 
function; 

3) Calculating the integers h=d" 1 modulo r, 
hi=f 2 *h modulo r and h 2 = c'*2 8t *h modulo r; 

4) Calculating the point P=hi.G+h 2 .W; 

5) Calculating the point Z=h.W; 

6) For j ranging from 0 to 2 8t -l, executing the 
following steps: 

6) a) If P=0, executing step 6)d); 

6) b) Associating the integer i with the point P 
and calculating the integer fi=c-i modulo r; 

6) c) Finding the message mi from f x and verifying 
that f 1 =R(m 1 ); if yes, executing step 8); 
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6) d) Replacing P with P+Z; 

7) The signature is not valid and the method is 
terminated; 

8) If the integer c=c'*2 8t +j does not belong to 
5 the interval [l,r-l], the signature is not valid; 

otherwise the signature is valid and the method is 
terminated . 

15. A method for modifying the signature scheme 
with partial reconstruction of the message according to 

10 any one of the preceding claims, characterised in that 
it consists in replacing the signature (c,d) with the 
signature (h 2 ,d) with h 2 =c*d" 1 modulo r. 

16. A method for improving the Nyberg-Rueppel 
signature scheme, said method comprising a signature 

15 generation method and a signature verification method, 
the said method consisting in including part of the 
message of size t bytes in the integer d, the signature 
being the pair of integers (c,d), t being a small 
integer, the t least significant bytes of the integer d 

20 containing t bytes of the message, the said method 
utilising a set having a group structure of order a 
prime number r, with a zero element denoted O and 
generating the point G, the private key being a 
positive integer s less than r and the public key being 

25 the point W=s.G, characterised in that the method of 
generating the signature of a message m using the 
integer parameters t, a and k includes the following 
seven steps: 

1) Calculating h=H (m) , H being a hash function; 
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2) Removing the t least significant bytes and 
the k most significant bytes of the message m and 
storing the result in m' ; 

3) Storing in f the result of the concatenation 
5 with m' of the a most significant bytes of h; 

4) Generating a random number u between 1 and r- 
1 and calculating V=u.G; 

5) Associating an integer i with the point V and 
calculating c=i+f modulo r; returning to step 4) if 

10 c=0; 

6) Calculating the integer d=u-s*c modulo r; if 
d is not equal to m modulo 2 8t returning to step 4) ; 

7) The signature is the pair of integers (c,d) ,- 
and in that the signature verification method 

15 includes the following seven steps: 

1) If c does not belong to the interval [l,r-l] 
or if d does not belong to the interval [0,r-l] , the 
signature is not valid; 

2) Calculating the point P=d.G+c.W; if P=0, the 
2 0 signature is not valid; 

3) Associating the integer i with the point P; 

4) Calculating the integer f=c-i modulo r; 

5) Concatenating the t least significant bytes 
of d with the message m' obtained from f by removing 

25 the a least significant bytes; 

6) For b ranging from 0 to 2 8k -l, repeating the 
following step: 

6) a) Concatenating the message m' with b in order 
to obtain m and calculating h=H (m) ; verifying that the 
30 a most significant bytes of h and the a least 
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significant bytes of f are identical; if yes, the 
signature of the message m is valid and the method is 
terminated; 

7) The signature is not valid. 
5 17. A method for generating and verifying an 

electronic signature according to any one of the 
preceding claims, characterised in that the operations 
are effected on an elliptic curve forming a group 
structure and having at least one point G, which is the 
10 generator of a sub-group of order a prime number r. 

18. A method for generating and verifying an 
electronic signature according to any one of the 
preceding claims, characterised in that the operations 
are effected in the multiplicative group of the 

15 integers modulo a prime number p. 

19. A method for generating and verifying an 
electronic signature according to any one of the 
preceding claims, characterised in that the operations 
are effected in a multiplicative sub-group of order a 

20 prime number r of the multiplicative group of the 
integers modulo a prime number p with r dividing p-1. 

20. An electronic device according to any one of 
the preceding claims, characterised in that the device 
performing the test is a portable device. 

25 21. An electronic device according to any one of 

the preceding claims, characterised in that the device 
is a smart card. 

22 . An electronic device according to any one of 
the preceding claims, characterised in that the device 

30 is a contactless card. 
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23. An electronic device according to any one of 
the preceding claims, characterised in that the device 
is a PCMCIA card. 

24. An electronic device according to any one of 
the preceding claims, characterised in that the device 
is a badge. 

25. An electronic device according to any one of 
the preceding claims, characterised in that the device 
is an intelligent watch. 
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